Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 04:00
Behavioral task
behavioral1
Sample
3fb16c66470b081e97496bb5c11b1f62098d5f9043dd9014832989863921ae72.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3fb16c66470b081e97496bb5c11b1f62098d5f9043dd9014832989863921ae72.dll
Resource
win10v2004-20240611-en
General
-
Target
3fb16c66470b081e97496bb5c11b1f62098d5f9043dd9014832989863921ae72.dll
-
Size
317KB
-
MD5
4f466fed6168acc232c9008c8fd63539
-
SHA1
f813c4268f6f85d4895528ada16949d2dd6a52f8
-
SHA256
3fb16c66470b081e97496bb5c11b1f62098d5f9043dd9014832989863921ae72
-
SHA512
ba023d7b80dc521d5953848e2987c53954dedf6b9a918b40ef5a33d4c4d80f660aae27674ee957ab265fc2304a5ed9f6102e6ae5eddb6295b77fe6ac63154a7c
-
SSDEEP
6144:T5v+4w3LWwgw0z1IjI8B+yiT47wEpqM1EtZOIV5QoSW:VvTeLjgw0hIjzks7JqmE/OIV5QoS
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2104-1-0x0000000010000000-0x0000000010111000-memory.dmp upx behavioral1/memory/2104-0-0x0000000010000000-0x0000000010111000-memory.dmp upx behavioral1/memory/2104-2-0x0000000010000000-0x0000000010111000-memory.dmp upx behavioral1/memory/2104-3-0x0000000010000000-0x0000000010111000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\SX.dll rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2104 rundll32.exe 2104 rundll32.exe 2104 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2104 2052 rundll32.exe 28 PID 2052 wrote to memory of 2104 2052 rundll32.exe 28 PID 2052 wrote to memory of 2104 2052 rundll32.exe 28 PID 2052 wrote to memory of 2104 2052 rundll32.exe 28 PID 2052 wrote to memory of 2104 2052 rundll32.exe 28 PID 2052 wrote to memory of 2104 2052 rundll32.exe 28 PID 2052 wrote to memory of 2104 2052 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3fb16c66470b081e97496bb5c11b1f62098d5f9043dd9014832989863921ae72.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3fb16c66470b081e97496bb5c11b1f62098d5f9043dd9014832989863921ae72.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2104
-